Data Protection Policy
1. Data protection principles
Action Dispatch is committed to processing data in accordance with its responsibilities under the GDPR.
Article 5 of the GDPR requires that personal data shall be
a. processed lawfully, fairly and in a transparent manner in relation to individuals
b. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
e. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
f. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”
2. General provisions
a. This policy applies to all personal data processed by Action Dispatch Ltd
b. The Responsible Person shall take responsibility for ongoing compliance with this policy.
c. This policy shall be reviewed at least annually.
d. Action Dispatch Ltd shall register with the DP Office as an organisation that processes personal data.
3. Lawful, fair and transparent processing
Personal data must be processed lawfully, fairly and in a transparent manner in relation to the Data Subject.
a. To ensure its processing of data is lawful, fair and transparent, Action Dispatch Ltd shall maintain a Register of Systems.
b. The Register of Systems shall be reviewed at least annually.
c. Individuals have the right to access their personal data and any such requests made to Action Dispatch Ltd shall be dealt with in a timely manner.
4. Lawful purposes
Personal Data is only collected for specified, explicit and legitimate purposes. Personal data is not further processed in any manner incompatible with those purposes. [These purposes are records in our Personal Data Register.]
Staff
Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
Date of birth
Gender
Marital status and dependants (for example might be required for pension purposes)
Next of kin and emergency contact information.
PPSN
Bank account details, payroll records and tax status information, Salary, Annual leave, pension and benefits information.
Start date
Location of employment or workplace.
Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
Employment records (including job titles, work history, working hours, training records and professional memberships).
Compensation history.
Performance information/ Disciplinary and grievance information.
CCTV footage and other information obtained through electronic means such as swipe card records.
Photographs for example for use in an identification card/ for identifying staff on a website etc.
Visa/ Immigration/ right to work or residential status.
How we collect the information:
We collect personal data about staff from the following sources:
The staff member themselves
The recruitment process, either directly from candidates or from third parties such as a recruitment agency or job search website;
We may collect additional information from third parties including former employers, background check provider or credit reference agencies;
References which have been provided to us.
Why we collect it
Where we need to comply with a legal obligation;
Where it is necessary for our legitimate interests and your interests.
Clients
Company name;
Location;
Contact details such as name, number and email;
Company Vat number;
Contact details for Accounts department such as name, number and email;
Bank account details;
How we collect our information
We collect personal data about clients from the following sources:
The Clients themselves
Why we collect it
Where it is necessary for our legitimate interests and their interests
a. All data processed by Action Dispatch LTD must be done on one of the following lawful bases: consent, contract, legal obligation,
b. Action Dispatch LTD shall note the appropriate lawful basis in the Personal Data Register
c. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data.
d. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent is clearly available and systems are in place to ensure such revocation is reflected accurately in the Action Dispatch’s systems.
5. Data minimisation
Action Dispatch LTD will only process Personal Data when performing our duties requires it. We will only collect Personal Data that is required for our duties and must not collect excessive data. Personnel should ensure that any Personal Data collected by them is adequate and relevant for the intended purposes.
Action Dispatch Ltd must ensure that when Personal Data is no longer needed for specified purposes, it is deleted or anonymised safely and securely in accordance with the firms Data Retention Policy.
Staff must ensure that they do not disclose personal data where there is no lawful basis for doing so.
This includes taking steps to redact personal data from communications where that personal data is not necessary for the purpose of the communication.
6. Accuracy
a. Action Dispatch Ltd shall take reasonable steps to ensure personal data is accurate.
b. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.
7. Archiving / removal
a. To ensure that personal data is kept for no longer than necessary, Action Dispatch Ltd shall put in place a record retention policy for each area in which personal data is processed and review this process annually.
b. The record retention policy shall consider what data should/must be retained, for how long, and why.
c. Staff must check the accuracy of any Personal Data at the point of collection. staff must take all reasonable steps to destroy or amend inaccurate or out-of-date Personal Data.
8. Security
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful Processing, and against accidental loss, destruction or damage. Action Dispatch Ltd will develop, implement and maintain safeguards appropriate to our size, scope and business, our available resources. We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our Processing of Personal Data.
Action Dispatch Ltd is responsible for protecting the Personal Data we hold. Action Dispatch Ltd implements reasonable and appropriate security measures against unlawful or unauthorised Processing of Personal Data and against the accidental loss of, or damage to, Personal Data.
Staff must follow all procedures and technologies we put in place to maintain the security of all Personal Data from the point of collection to the point of destruction. Action Dispatch Ltd will only transfer Personal Data to third-party service providers who agree to comply with the required policies and procedures and who agree to put adequate measures in place, as requested.
Action Dispatch Ltd will maintain data security by protecting the confidentiality, integrity and availability of the Personal Data, defined as follows:
1. Confidentiality means that only people who have a need to know and are authorised to use the Personal Data can access it
2. Integrity means that Personal Data is accurate and suitable for the purpose for which it is processed.
3. Availability means that authorised users are able to access the Personal Data when they need it for authorised purposes.
Staff must comply with all applicable aspects of Action Dispatch’s Safe Driving policy, ISO quality policy and confidently policy.
9. Breach
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Firm shall promptly assess the risk to people’s rights and if appropriate report this breach to the Data Protection Commissioner. Action Dispatch Ltd has put in place procedures and a Data Breach Policy to deal with any suspected Personal Data Breach and will notify Data Subject, supervisory authority or any applicable regulator where we are legally required to do so.
10. Privacy by Design
Data Protection Impact Assessment Staff must conduct a DPIA when implementing major system or business change programs involving the Processing of Personal Data including:
1. Use of new technologies (programs, systems or processes), or changing technologies (programs, systems or processes);
2. Automated Processing
3. Large scale Processing of Special Category Data
11. Transfer Limitation
Action Dispatch Ltd may only transfer Personal Data outside the EEA if one of the following conditions applies:
i. the European Commission has issued a decision confirming that the country to which we transfer the Personal Data ensures an adequate level of protection for the Data Subjects’ rights and freedoms;
ii. appropriate safeguards are in place such as standard contractual clauses approved by the European Commission, an approved code of conduct or a certification
mechanism
iii. the Data Subject has provided Explicit Consent to the proposed transfer after being informed of any potential risks; or
iv. the transfer is necessary for one of the other reasons set out in the GDPR including the performance of a contract between us and the Data Subject, reasons of public interest, to establish, exercise or defend legal claims or to protect the vital interests of the Data Subject where the Data Subject is physically or legally incapable of giving Consent and, in some limited cases, for our legitimate interest.
Subject access requests
Under Section 4 of the Data Protection Acts 1988 and 2003, data subjects have a right to obtain a copy, clearly explained, of any information relating to them that is kept on computer or in a structured manual filing system or intended for such a system by any entity or organisation.
Data subjects can request this by submitting a request in writing to us at …Action Dispatch Ltd, Classic House, Green Street, D07K76P. There is no charge to make a request and we will respond to a request within one month.
Failure to comply with the policy
The importance of this policy means that failure to comply with any requirement may lead to disciplinary action under the firms’ procedures, which may result in disciplinary action.
